Identity threat detection now spans human, NHI, and AI agents

At a glance

What this is: Permiso Security’s award write-up argues that identity threat detection must follow behaviour after authentication, because human, NHI and AI agent activity can all look legitimate while still masking compromise.

Why it matters: Identity and IAM teams need controls that detect abuse inside valid sessions, not just at sign-in, because traditional IAM, PAM and MFA controls do not cover post-authentication misuse across human, NHI and autonomous activity.

Context

Identity threat detection is the practice of watching what an identity does after it authenticates, not just whether the login succeeded. That matters because modern attacks often arrive through valid credentials and then blend into normal activity across human users, service accounts and AI agents.

Permiso Security’s award write-up uses that governance gap to argue that IAM, PAM and MFA solve front-door access questions but do not, by themselves, reveal compromise inside an active session. The practical issue for identity programmes is that post-authentication behaviour has become part of the control surface, especially in cloud and hybrid environments.

Key questions

Q: Where does identity threat detection fail when it stops at authentication?

A: It fails when compromise begins after a valid login, because access tools can only confirm that entry was allowed. Once an attacker operates inside an approved session, the control gap shifts to behaviour, privilege use and session correlation. That is why ITDR focuses on what authenticated identities do next, not just whether sign-in succeeded.

Q: Why do service accounts and AI agents need different controls from human users?

A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.

Q: What are the signs that identity threat detection is failing in an enterprise environment?

A: Warning signs include breaches being identified by customers or external parties, long investigation windows with little internal evidence, and attackers remaining active for weeks without being detected. Another signal is when security teams rely on preventive tools alone and have no behavioral visibility into post-authentication activity. That leaves trusted identities effectively invisible once access is granted.

Q: How should security teams implement identity threat detection in IAM programmes?

A: Start by connecting authentication, session, device, and privilege telemetry so access decisions can be evaluated continuously rather than only at sign-in. Then define response actions for suspicious behaviour, including step-up challenges, session revocation, and privileged access suspension. The goal is to make identity risk observable and actionable inside the access lifecycle.

Technical breakdown

Why post-authentication behaviour is the real detection layer

Traditional identity controls are designed to decide whether access should be granted. Identity threat detection and response, by contrast, observes how an authenticated identity behaves after access is already in place. That distinction matters because attackers increasingly use legitimate credentials, then pivot, enumerate, or escalate while remaining inside approved sessions. Behavioural detection builds a baseline for normal activity and compares each action, sequence, and context signal against that baseline. In identity-heavy environments, that approach is closer to runtime monitoring than to access administration, and it is the only layer that can catch misuse after the login event has already passed.

Practical implication: Treat post-authentication telemetry as a primary detection source, not a secondary investigation aid.

Why ITDR must cover human, NHI and AI agent identities

Identity threat detection loses value if it only watches human logins. Service accounts, API keys and AI agents now generate a large share of machine-driven activity, and all of them can be used to create plausible attacker movement inside cloud and hybrid environments. The important point is not that these identities exist, but that they authenticate, hold credentials, and perform actions that can be abused without looking unusual at the access layer. Coverage across identity types gives analysts one behavioural model for different execution forms, instead of separate blind spots for each identity class.

Practical implication: Extend behavioural detection and investigation coverage to service accounts, tokens and AI agents, not just employee accounts.

How identity graphs change compromise investigation

An identity graph links actions, credentials, sessions and relationships so analysts can reconstruct who or what actually did the work during an incident. That matters when compromise spans multiple identities, because a single alert rarely explains the full path of abuse. Graph-based correlation turns scattered events into a sequence that shows lateral movement, privilege use, and identity chaining across cloud and on-premises systems. In practice, the graph is what makes ITDR operational rather than merely observability-driven: it supports both detection and the analytical path needed to contain the issue quickly.

Practical implication: Use graph-based correlation to trace privilege use and lateral movement across identity boundaries.

Threat narrative

Attacker objective: The objective is to remain inside the environment under the cover of legitimate identity activity long enough to move, escalate and act without triggering front-door controls.

1. Entry occurs when an attacker arrives with valid credentials rather than by breaking the perimeter, which makes the initial session look legitimate.
2. Credential access is already implicit in the scenario because the attacker is operating as a compromised but legitimate identity, not as an unauthorised outsider.
3. Escalation happens when that identity performs behaviour that diverges from its normal pattern while still retaining approved access.
4. Impact follows when the activity remains hidden inside trusted identity traffic long enough to enable privilege abuse, session hijacking or insider-like misuse.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Post-authentication behaviour is now the decisive identity control plane. Identity security no longer ends at authentication, because attackers increasingly enter with valid credentials and then operate inside trusted sessions. IAM, PAM and MFA still matter, but they are front-door controls and were never meant to explain what an identity does after it is admitted. Practitioners need to treat runtime identity behaviour as a first-class governance domain, not as an investigation afterthought.

ITDR closes a control gap that access governance cannot cover. Access tools decide whether an identity may enter, but they do not tell you whether the authenticated identity is behaving like the subject it claims to be. That gap is especially visible in environments where service accounts and AI agents generate high-volume activity that looks normal at login time. The implication is that identity programmes now need behavioural evidence alongside entitlement evidence.

Identity coverage must extend to non-human and autonomous actors or the programme will blind itself. As service accounts, API keys and AI agents outnumber human users in many environments, a human-only detection model describes less and less of the real attack surface. This is not just an NHI issue, because the same behavioural pattern applies across human, machine and autonomous identities. The practitioner conclusion is simple: if the programme cannot see every authenticated actor, it cannot claim identity visibility.

Runtime correlation is the new investigation primitive. The most useful identity security outputs are no longer isolated alerts but linked action trails that show who did what across cloud and hybrid systems. That makes graph-based correlation foundational to modern identity threat response because it compresses triage, clarifies lateral movement, and exposes the identity chain behind the incident. Teams should evaluate whether their tooling can reconstruct a session path, not just raise a signal.

Identity threat detection is becoming the operational layer for agentic AI governance. AI agents are not separate from identity security, because they authenticate, hold credentials and act inside enterprise systems. Once those actions can happen without a human watching every step, detection has to follow behaviour, not approval flow. Practitioners should treat AI agent observability as part of the same identity control set used for NHIs and privileged users.

What this signals

Post-authentication visibility is becoming a baseline requirement, not a niche detection feature. Identity programmes built only around provisioning, MFA and privileged access will continue to miss the most common modern abuse pattern: a valid identity that behaves badly after entry. That changes how teams should think about control coverage, because the decisive evidence now lives inside the session rather than at the door.

Identity Threat Detection and Response now has to cover every authenticated actor. When service accounts and AI agents are part of the same operating environment as users, a human-only monitoring model creates governance gaps that attackers can exploit. The programme implication is broader telemetry, clearer identity-to-action attribution and investigation workflows that can follow activity across identity classes.

Behavioural correlation is the real differentiator in identity operations. Teams that can link session activity, privilege use and identity relationships will shorten investigations and reduce ambiguity after suspected compromise. That is especially important as autonomous activity grows, because the control question shifts from who signed in to what the identity did after it was already trusted.

For practitioners

• Expand detection beyond login events Instrument telemetry that captures commands, resource access, privilege use and session changes after authentication, then correlate those signals back to the identity that executed them.
• Include service accounts and AI agents in detection coverage Map every non-human and autonomous identity into the same behavioural monitoring policy used for employees so blind spots do not form around tokens, agents or workloads.
• Use identity graphs for incident reconstruction Link identities, sessions and actions so analysts can see lateral movement, privilege chaining and suspicious activity paths across cloud and on-premises environments.
• Prioritise anomalous post-authentication behaviour Tune use cases around impossible sequences, unusual resource access, atypical privilege use and session hijacking indicators rather than relying only on authentication failure events.

Key takeaways

• Identity security is shifting from authentication checks to behaviour monitoring after access is granted.
• The article’s core warning is that valid credentials can still hide malicious activity inside trusted sessions across users, service accounts and AI agents.
• Teams need detection that spans all authenticated actors and can reconstruct the action trail, not just the sign-in event.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Post-authentication behaviour: Post-authentication behaviour is what an identity does after access has been accepted. For machine and AI identities, that includes token reuse, secret retrieval, lateral movement, and policy deviation, which means defenders must watch execution patterns, not only login outcomes.
• Identity Graph: An identity graph is a relationship map that connects identities, assets, data, and permissions so teams can see how access actually flows. In NHI programmes, it helps explain which agent is related to which owner, which system, and which policy boundary.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.